In a recent statement posted on the social media platform X, Bitget’s chief executive officer, Gracy Chen, clarified the mechanics behind the massive security incident that saw the cryptocurrency exchange lose roughly $351.6 million. Contrary to early speculation that the breach might have involved the theft of private keys— the cryptographic secrets that grant full control over digital assets—Chen emphasized that the attackers did not actually obtain any private keys.
Instead, the perpetrators exploited a vulnerability in the exchange’s wallet backend system and carried out a series of spoofed, or counterfeit, transfers that allowed them to move funds illicitly. The distinction Chen highlighted is critical for both industry observers and users of the platform.
Private keys are the fundamental building blocks of blockchain security; if a malicious actor gains access to them, they can directly sign transactions and withdraw assets from any address under their control. In Bitset’s case, however, the attackers bypassed this layer of protection entirely. By compromising the internal wallet management software— the component that processes deposit and withdrawal requests— they were able to manipulate the transaction data that the system uses to validate and execute transfers. This manipulation effectively created a false narrative of legitimate withdrawals, prompting the system to release the assets to addresses controlled by the criminals.
According to Chen’s explanation, the hack unfolded in several stages. First, the malicious actors gained unauthorized entry into the wallet backend, possibly through a combination of phishing, credential stuffing, or exploiting an unpatched software vulnerability. Once inside, they did not attempt to extract private keys from the system’s secure storage.
Instead, they focused on the transaction‑generation module, which assembles the details of each transfer— such as the sender, recipient, amount, and associated metadata— before the request is signed and broadcast to the blockchain. By altering these details, the attackers were able to fabricate withdrawal requests that appeared authentic to the exchange’s internal checks.
The spoofed transactions were then signed using the exchange’s own legitimate signing keys, which the system automatically trusted because the request originated from its own infrastructure. As a result, the blockchain recorded the transfers as genuine, and the funds were moved to wallets under the attackers’ control without triggering the usual alarms that would arise from a private‑key compromise.
Chen stressed that this method of attack underscores a broader security challenge facing centralized cryptocurrency platforms: the need to protect not only the cryptographic keys that guard assets but also the surrounding software and operational processes that handle transaction creation and approval. While many exchanges invest heavily in hardware security modules (HSMs) and multi‑signature schemes to safeguard private keys, the Bitget incident demonstrates that a breach of the surrounding application layer can be just as devastating. In response to the breach, Bitget has reportedly taken several immediate remedial actions.
The exchange has isolated the compromised portion of its wallet infrastructure, conducted a thorough forensic analysis to pinpoint the exact entry point, and begun the process of patching any identified vulnerabilities. Additionally, the company is working closely with law‑enforcement agencies and blockchain analytics firms to trace the stolen funds, many of which may have already been moved through a series of mixers and tumblers designed to obscure their origin. The incident also raises questions about the adequacy of existing regulatory frameworks for digital asset custodians. Regulators worldwide are increasingly scrutinizing exchanges for robust internal controls, including segregation of duties, real‑time monitoring of transaction anomalies, and mandatory incident‑response protocols.
Chen’s remarks suggest that Bitget will be revisiting its compliance posture, potentially implementing stricter access controls, multi‑factor authentication for privileged accounts, and enhanced logging mechanisms to detect suspicious activity earlier. For users of Bitget and other similar platforms, the episode serves as a reminder to remain vigilant.
While the exchange bears primary responsibility for safeguarding deposited assets, customers can also adopt best practices such as limiting the amount of capital kept on exchanges, employing hardware wallets for long‑term storage, and regularly reviewing account activity for any unexpected withdrawals. In summary, the $351.6 million loss suffered by Bitget was not the result of a direct theft of private keys but rather a sophisticated manipulation of the exchange’s transaction processing system. By spoofing transfer data within the wallet backend, the attackers were able to bypass traditional security safeguards and move a substantial amount of cryptocurrency to their own addresses. The episode highlights the evolving nature of cyber threats in the crypto space, where attackers increasingly target the software and operational layers surrounding cryptographic assets.
Bitget’s leadership, led by CEO Gracy Chen, has publicly acknowledged the breach, outlined the technical details of the attack, and pledged to strengthen the platform’s defenses to prevent similar incidents in the future.